CVE-2025-54576

CriticalPublic PoC

Published: 30 July 2025

Published

30 July 2025

Modified

10 September 2025

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0020 41.9th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-54576 is a critical-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Oauth2 Proxy Project Oauth2 Proxy. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Requires timely remediation of identified flaws, such as patching OAuth2-Proxy to version 7.11.0, which directly fixes the authentication bypass vulnerability.

CM-6 Configuration Settings good match

prevent

Mandates secure configuration settings for skip_auth_routes, including anchored regex patterns or exact path matches that exclude query parameters, preventing crafted URL bypasses.

AC-14 Permitted Actions Without Identification or Authentication partial match

prevent

Requires explicit definition and authorization of actions or routes permitted without authentication, ensuring skip_auth_routes configurations are not overly permissive.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Authentication bypass in public-facing OAuth2-Proxy reverse proxy directly enables T1190 exploitation of exposed applications for unauthorized access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions 7.10.0 and below, oauth2-proxy deployments are vulnerable when using the skip_auth_routes…

configuration option with regex patterns. Attackers can bypass authentication by crafting URLs with query parameters that satisfy configured regex patterns, allowing unauthorized access to protected resources. The issue stems from skip_auth_routes matching against the full request URI. Deployments using skip_auth_routes with regex patterns containing wildcards or broad matching patterns are most at risk. This issue is fixed in version 7.11.0. Workarounds include: auditing all skip_auth_routes configurations for overly permissive patterns, replacing wildcard patterns with exact path matches where possible, ensuring regex patterns are properly anchored (starting with ^ and ending with $), or implementing custom validation that strips query parameters before regex matching.

Deeper analysisAI

CVE-2025-54576 is a high-severity authentication bypass vulnerability (CVSS 3.1 score of 9.1, CWE-290) in OAuth2-Proxy, an open-source tool that functions as a standalone reverse proxy or middleware integrated into existing reverse proxies or load balancers. It affects versions 7.10.0 and below when the skip_auth_routes configuration option is used with regex patterns. The flaw occurs because skip_auth_routes matching is performed against the full request URI, including query parameters, allowing attackers to craft malicious URLs that satisfy the regex patterns and bypass authentication checks for protected resources. Deployments with wildcard or broad matching patterns in skip_auth_routes are particularly at risk.

Any network-accessible attacker (AV:N/AC:L/PR:N) can exploit this vulnerability without user interaction or privileges by sending crafted requests with query parameters that trigger a regex match on skip_auth_routes. Successful exploitation grants unauthorized access to protected resources, potentially leading to high confidentiality and integrity impacts (C:H/I:H) such as data exposure or modification, depending on the backend services.

The vulnerability is fixed in OAuth2-Proxy version 7.11.0. Mitigation guidance from the GitHub security advisory (GHSA-7rh7-c77v-6434) and release notes includes auditing all skip_auth_routes configurations for overly permissive patterns, replacing wildcards with exact path matches where possible, anchoring regex patterns with ^ and $, or implementing custom validation that strips query parameters before matching. Relevant code changes and commit details are available in the project's GitHub repository.